📘 Authorization Patterns: Access Control

🎯 Introduction

Welcome to this exciting tutorial on authorization patterns and access control! 🎉 In this guide, we’ll explore how to build secure, type-safe authorization systems that protect your application’s resources.

You’ll discover how proper authorization patterns can transform your TypeScript applications into secure fortresses 🏰. Whether you’re building web applications 🌐, APIs 🖥️, or enterprise systems 📚, understanding authorization is essential for protecting user data and maintaining system integrity.

By the end of this tutorial, you’ll feel confident implementing robust access control in your own projects! Let’s dive in! 🏊‍♂️

📚 Understanding Authorization Patterns

🤔 What is Authorization?

Authorization is like being a bouncer at an exclusive club 🎭. Think of it as a security checkpoint that decides who gets access to what resources. While authentication asks “Who are you?”, authorization asks “What are you allowed to do?” 🔐

In TypeScript terms, authorization is the process of determining if an authenticated user has permission to perform specific actions or access certain resources. This means you can:

• ✨ Control access to sensitive data
• 🚀 Implement role-based permissions
• 🛡️ Protect critical operations

💡 Why Use Authorization Patterns?

Here’s why developers prioritize authorization:

1. Security 🔒: Protect sensitive resources from unauthorized access
2. Compliance 💻: Meet regulatory requirements (GDPR, HIPAA, etc.)
3. User Experience 📖: Show users only what they can access
4. Scalability 🔧: Manage complex permission systems efficiently

Real-world example: Imagine building a hospital management system 🏥. With proper authorization, doctors can access patient records, nurses can update vitals, but visitors can only see general information.

🔧 Basic Syntax and Usage

📝 Simple Example

Let’s start with a friendly example:

// 👋 Hello, Authorization!
type Role = "admin" | "user" | "guest";

// 🎨 Creating a simple user interface
interface User {
  id: string;        // 👤 User identifier
  name: string;      // 📝 User's name
  role: Role;        // 🎭 User's role
  permissions?: string[];  // 🔑 Optional specific permissions
}

// 🛡️ Basic permission check
const canAccess = (user: User, resource: string): boolean => {
  // 🎯 Admins can access everything!
  if (user.role === "admin") return true;
  
  // 🔍 Check specific permissions
  return user.permissions?.includes(resource) || false;
};

💡 Explanation: Notice how we use union types for roles and optional permissions for flexibility!

🎯 Common Patterns

Here are patterns you’ll use daily:

// 🏗️ Pattern 1: Role-Based Access Control (RBAC)
const rolePermissions: Record<Role, string[]> = {
  admin: ["read", "write", "delete", "manage_users"],
  user: ["read", "write"],
  guest: ["read"]
};

// 🎨 Pattern 2: Permission-based checks
type Permission = "read" | "write" | "delete" | "manage_users";

const hasPermission = (user: User, permission: Permission): boolean => {
  const userPermissions = rolePermissions[user.role];
  return userPermissions.includes(permission);
};

// 🔄 Pattern 3: Resource-based authorization
interface Resource {
  id: string;
  ownerId: string;
  visibility: "public" | "private" | "restricted";
}

const canAccessResource = (user: User, resource: Resource): boolean => {
  // 🌍 Public resources are accessible to all
  if (resource.visibility === "public") return true;
  
  // 👤 Owners can always access their resources
  if (resource.ownerId === user.id) return true;
  
  // 🎯 Check role-based access
  return user.role === "admin";
};

💡 Practical Examples

🛒 Example 1: E-Commerce Access Control

Let’s build something real:

// 🛍️ Define our order and product types
interface Product {
  id: string;
  name: string;
  price: number;
  status: "active" | "draft" | "archived";
}

interface Order {
  id: string;
  userId: string;
  products: Product[];
  total: number;
  status: "pending" | "completed" | "cancelled";
}

// 🛡️ Authorization service
class AuthorizationService {
  // 🔐 Check if user can view order
  canViewOrder(user: User, order: Order): boolean {
    // 👤 Users can view their own orders
    if (order.userId === user.id) return true;
    
    // 👮 Admins and support can view all orders
    return ["admin", "support"].includes(user.role);
  }
  
  // 💳 Check if user can process refund
  canProcessRefund(user: User, order: Order): boolean {
    // 🚫 Only completed orders can be refunded
    if (order.status !== "completed") return false;
    
    // 💰 Only admins and finance team can process refunds
    return user.role === "admin" || 
           user.permissions?.includes("process_refunds") || false;
  }
  
  // 📝 Check if user can modify product
  canModifyProduct(user: User, product: Product): boolean {
    // 🔒 Archived products can't be modified
    if (product.status === "archived") return false;
    
    // ✏️ Admins and product managers can modify
    return user.role === "admin" || 
           user.permissions?.includes("manage_products") || false;
  }
}

// 🎮 Let's use it!
const authService = new AuthorizationService();
const currentUser: User = {
  id: "123",
  name: "Sarah",
  role: "user"
};

const myOrder: Order = {
  id: "order-456",
  userId: "123",
  products: [],
  total: 99.99,
  status: "completed"
};

console.log(`Can view order: ${authService.canViewOrder(currentUser, myOrder) ? "✅" : "❌"}`);
console.log(`Can process refund: ${authService.canProcessRefund(currentUser, myOrder) ? "✅" : "❌"}`);

🎯 Try it yourself: Add a feature to check if users can apply discount codes based on their membership level!

🎮 Example 2: Multi-Tenant Application

Let’s make it more complex:

// 🏢 Multi-tenant authorization system
interface Tenant {
  id: string;
  name: string;
  plan: "free" | "pro" | "enterprise";
}

interface TenantUser extends User {
  tenantId: string;
  tenantRole: "owner" | "admin" | "member" | "viewer";
}

// 🎯 Feature flags based on tenant plan
const featureAccess: Record<string, string[]> = {
  free: ["basic_reports", "5_users"],
  pro: ["basic_reports", "advanced_reports", "50_users", "api_access"],
  enterprise: ["all_features", "unlimited_users", "custom_integrations"]
};

class TenantAuthorizationService {
  private tenants: Map<string, Tenant> = new Map();
  
  // 🏗️ Check if tenant has access to feature
  tenantHasFeature(tenantId: string, feature: string): boolean {
    const tenant = this.tenants.get(tenantId);
    if (!tenant) return false;
    
    const planFeatures = featureAccess[tenant.plan];
    return planFeatures.includes(feature) || 
           planFeatures.includes("all_features");
  }
  
  // 👤 Check user permissions within tenant
  canUserPerformAction(
    user: TenantUser, 
    action: string, 
    resource: string
  ): boolean {
    // 🚫 First check if tenant has the feature
    if (!this.tenantHasFeature(user.tenantId, resource)) {
      console.log("🚫 Tenant plan doesn't include this feature!");
      return false;
    }
    
    // 🎭 Check user's tenant role
    const roleHierarchy = {
      owner: 4,
      admin: 3,
      member: 2,
      viewer: 1
    };
    
    const requiredLevel = this.getRequiredLevel(action);
    return roleHierarchy[user.tenantRole] >= requiredLevel;
  }
  
  // 📊 Get required permission level
  private getRequiredLevel(action: string): number {
    const actionLevels: Record<string, number> = {
      view: 1,
      create: 2,
      edit: 2,
      delete: 3,
      manage: 4
    };
    return actionLevels[action] || 4;
  }
}

🚀 Advanced Concepts

🧙‍♂️ Advanced Topic 1: Attribute-Based Access Control (ABAC)

When you’re ready to level up, try this advanced pattern:

// 🎯 Advanced attribute-based authorization
interface AuthContext {
  user: User;
  resource: any;
  action: string;
  environment: {
    time: Date;
    ipAddress: string;
    location?: string;
  };
}

// 🪄 Policy definition
type PolicyRule = (context: AuthContext) => boolean;

interface Policy {
  name: string;
  description: string;
  rules: PolicyRule[];
  effect: "allow" | "deny";
}

// 🌟 Advanced policy engine
class PolicyEngine {
  private policies: Policy[] = [];
  
  // ➕ Add a policy
  addPolicy(policy: Policy): void {
    this.policies.push(policy);
    console.log(`✨ Added policy: ${policy.name}`);
  }
  
  // 🔍 Evaluate all policies
  evaluate(context: AuthContext): boolean {
    // 📋 Collect all applicable policies
    const results = this.policies.map(policy => {
      const allRulesPassed = policy.rules.every(rule => rule(context));
      return { passed: allRulesPassed, effect: policy.effect };
    });
    
    // 🚫 Deny takes precedence
    const hasDeny = results.some(r => r.passed && r.effect === "deny");
    if (hasDeny) return false;
    
    // ✅ At least one allow
    return results.some(r => r.passed && r.effect === "allow");
  }
}

// 🎮 Example policy
const workingHoursPolicy: Policy = {
  name: "Working Hours Access",
  description: "Allow access only during working hours",
  effect: "allow",
  rules: [
    (ctx) => {
      const hour = ctx.environment.time.getHours();
      return hour >= 9 && hour <= 17; // 🕐 9 AM to 5 PM
    },
    (ctx) => ctx.user.role !== "guest" // 🚫 No guests
  ]
};

🏗️ Advanced Topic 2: Dynamic Permission System

For the brave developers:

// 🚀 Type-safe dynamic permissions
type PermissionScope = {
  resource: string;
  actions: string[];
  conditions?: Record<string, any>;
};

// 💫 Permission builder with fluent API
class PermissionBuilder {
  private scopes: PermissionScope[] = [];
  
  // 🎯 Add resource permission
  on(resource: string): this {
    this.scopes.push({ resource, actions: [] });
    return this;
  }
  
  // ➕ Allow specific actions
  allow(...actions: string[]): this {
    const current = this.scopes[this.scopes.length - 1];
    if (current) {
      current.actions.push(...actions);
    }
    return this;
  }
  
  // 🔐 Add conditions
  when(conditions: Record<string, any>): this {
    const current = this.scopes[this.scopes.length - 1];
    if (current) {
      current.conditions = conditions;
    }
    return this;
  }
  
  // 🏗️ Build final permission set
  build(): PermissionScope[] {
    return this.scopes;
  }
}

// 🎨 Usage example
const permissions = new PermissionBuilder()
  .on("posts")
    .allow("read", "write")
    .when({ isOwner: true })
  .on("comments")
    .allow("read")
    .allow("write")
    .when({ isVerified: true })
  .build();

⚠️ Common Pitfalls and Solutions

😱 Pitfall 1: The “Always Admin” Trap

// ❌ Wrong way - hardcoding admin checks everywhere!
const deletePost = (user: User, postId: string) => {
  if (user.role === "admin") {
    // Delete logic
  }
  // 💥 What about post owners? Moderators?
};

// ✅ Correct way - flexible permission system!
const deletePost = (user: User, post: Post) => {
  const canDelete = 
    user.role === "admin" ||
    post.authorId === user.id ||
    user.permissions?.includes("moderate_posts");
    
  if (canDelete) {
    console.log("🗑️ Post deleted successfully!");
    // Delete logic
  }
};

🤯 Pitfall 2: Forgetting Default Deny

// ❌ Dangerous - undefined means access!
const hasAccess = (permissions?: string[], required: string): boolean => {
  return permissions?.includes(required); // 💥 Returns undefined if no permissions!
};

// ✅ Safe - explicit default deny!
const hasAccess = (permissions?: string[], required: string): boolean => {
  return permissions?.includes(required) || false; // 🛡️ Always returns boolean
};

// 🎯 Even better - fail closed pattern
const secureAccess = (user: User, resource: string): boolean => {
  try {
    // Check various permission sources
    const hasRole = checkRolePermission(user, resource);
    const hasExplicit = checkExplicitPermission(user, resource);
    const hasDelegate = checkDelegatedPermission(user, resource);
    
    return hasRole || hasExplicit || hasDelegate;
  } catch (error) {
    console.error("⚠️ Authorization check failed:", error);
    return false; // 🔒 Fail closed!
  }
};

🛠️ Best Practices

1. 🎯 Principle of Least Privilege: Grant minimum necessary permissions
2. 📝 Audit Everything: Log all authorization decisions
3. 🛡️ Fail Closed: Default to deny when uncertain
4. 🎨 Separation of Concerns: Keep auth logic separate from business logic
5. ✨ Type Safety: Use TypeScript to enforce permission contracts

🧪 Hands-On Exercise

🎯 Challenge: Build a Document Management System

Create a type-safe document authorization system:

📋 Requirements:

• ✅ Documents have owners, collaborators, and viewers
• 🏷️ Support folders with inherited permissions
• 👤 Implement sharing with external users
• 📅 Time-based access (temporary links)
• 🎨 Each permission level needs an emoji!

🚀 Bonus Points:

• Add audit logging for all access attempts
• Implement permission delegation
• Create a permission conflict resolver

💡 Solution

// 🎯 Our type-safe document system!
type AccessLevel = "owner" | "editor" | "viewer";
type ShareType = "permanent" | "temporary";

interface Document {
  id: string;
  title: string;
  ownerId: string;
  folderId?: string;
  createdAt: Date;
  emoji: string; // Every doc needs an emoji! 📄
}

interface Permission {
  userId: string;
  documentId: string;
  level: AccessLevel;
  grantedBy: string;
  expiresAt?: Date;
}

interface Folder {
  id: string;
  name: string;
  parentId?: string;
  permissions: Permission[];
}

class DocumentAuthorizationSystem {
  private permissions: Permission[] = [];
  private folders: Map<string, Folder> = new Map();
  private auditLog: Array<{
    timestamp: Date;
    userId: string;
    action: string;
    documentId: string;
    allowed: boolean;
  }> = [];
  
  // 🔐 Check document access
  canAccessDocument(
    userId: string, 
    document: Document, 
    requiredLevel: AccessLevel
  ): boolean {
    const startTime = Date.now();
    
    // 👤 Owner always has access
    if (document.ownerId === userId) {
      this.logAccess(userId, "access", document.id, true);
      return true;
    }
    
    // 🔍 Check direct permissions
    const permission = this.permissions.find(
      p => p.userId === userId && p.documentId === document.id
    );
    
    if (permission) {
      // ⏰ Check expiration
      if (permission.expiresAt && permission.expiresAt < new Date()) {
        this.logAccess(userId, "access", document.id, false);
        console.log("⏰ Permission expired!");
        return false;
      }
      
      const allowed = this.hasRequiredLevel(permission.level, requiredLevel);
      this.logAccess(userId, "access", document.id, allowed);
      return allowed;
    }
    
    // 📁 Check folder permissions
    if (document.folderId) {
      const folderAccess = this.checkFolderAccess(userId, document.folderId, requiredLevel);
      this.logAccess(userId, "access", document.id, folderAccess);
      return folderAccess;
    }
    
    this.logAccess(userId, "access", document.id, false);
    return false;
  }
  
  // 🎯 Share document
  shareDocument(
    ownerId: string,
    documentId: string,
    shareWithUserId: string,
    level: AccessLevel,
    shareType: ShareType,
    durationHours?: number
  ): boolean {
    // Verify owner
    const doc = { id: documentId, ownerId } as Document;
    if (!this.canAccessDocument(ownerId, doc, "owner")) {
      console.log("🚫 Only owners can share!");
      return false;
    }
    
    const permission: Permission = {
      userId: shareWithUserId,
      documentId,
      level,
      grantedBy: ownerId,
      expiresAt: shareType === "temporary" && durationHours
        ? new Date(Date.now() + durationHours * 60 * 60 * 1000)
        : undefined
    };
    
    this.permissions.push(permission);
    console.log(`✅ Shared ${this.getLevelEmoji(level)} access with user!`);
    
    if (shareType === "temporary") {
      console.log(`⏰ Access expires in ${durationHours} hours`);
    }
    
    return true;
  }
  
  // 📊 Get access level hierarchy
  private hasRequiredLevel(userLevel: AccessLevel, required: AccessLevel): boolean {
    const levels: Record<AccessLevel, number> = {
      owner: 3,
      editor: 2,
      viewer: 1
    };
    return levels[userLevel] >= levels[required];
  }
  
  // 🎨 Get emoji for access level
  private getLevelEmoji(level: AccessLevel): string {
    const emojis: Record<AccessLevel, string> = {
      owner: "👑",
      editor: "✏️",
      viewer: "👁️"
    };
    return emojis[level];
  }
  
  // 📁 Check folder permissions (recursive)
  private checkFolderAccess(
    userId: string,
    folderId: string,
    requiredLevel: AccessLevel
  ): boolean {
    const folder = this.folders.get(folderId);
    if (!folder) return false;
    
    // Check folder permissions
    const folderPerm = folder.permissions.find(p => p.userId === userId);
    if (folderPerm && this.hasRequiredLevel(folderPerm.level, requiredLevel)) {
      return true;
    }
    
    // Check parent folder
    if (folder.parentId) {
      return this.checkFolderAccess(userId, folder.parentId, requiredLevel);
    }
    
    return false;
  }
  
  // 📝 Audit logging
  private logAccess(
    userId: string,
    action: string,
    documentId: string,
    allowed: boolean
  ): void {
    this.auditLog.push({
      timestamp: new Date(),
      userId,
      action,
      documentId,
      allowed
    });
  }
  
  // 📊 Get audit report
  getAuditReport(): void {
    console.log("📊 Access Audit Report:");
    console.log(`  📝 Total attempts: ${this.auditLog.length}`);
    console.log(`  ✅ Allowed: ${this.auditLog.filter(l => l.allowed).length}`);
    console.log(`  ❌ Denied: ${this.auditLog.filter(l => !l.allowed).length}`);
  }
}

// 🎮 Test it out!
const docAuth = new DocumentAuthorizationSystem();
const myDoc: Document = {
  id: "doc-123",
  title: "Secret Plans",
  ownerId: "user-1",
  createdAt: new Date(),
  emoji: "🔒"
};

// Share with temporary access
docAuth.shareDocument("user-1", "doc-123", "user-2", "viewer", "temporary", 24);

🎓 Key Takeaways

You’ve learned so much! Here’s what you can now do:

• ✅ Implement RBAC with confidence 💪
• ✅ Build secure access control systems 🛡️
• ✅ Avoid common security pitfalls 🎯
• ✅ Create flexible permission models 🐛
• ✅ Design type-safe authorization with TypeScript! 🚀

Remember: Security is not a feature, it’s a foundation! Always think “deny by default” and grant permissions explicitly. 🤝

🤝 Next Steps

Congratulations! 🎉 You’ve mastered authorization patterns and access control!

Here’s what to do next:

1. 💻 Practice with the exercises above
2. 🏗️ Build an authorization system for your project
3. 📚 Move on to our next tutorial: Session Management Security
4. 🌟 Share your secure implementations with others!

Remember: Every security expert started by learning the basics. Keep building secure systems, keep learning, and most importantly, keep your users’ data safe! 🚀

Happy coding! 🎉🚀✨